ExamRange – CSA 312-39 Simulation: Payload Obfuscation

Scenario Context

You are the Tier 3 SOC Analyst handling escalations for an enterprise e-commerce platform. A Level 1 analyst has escalated a WAF alert that triggered on the API gateway. The payload looks malformed, and the L1 analyst is unsure if it is a false positive generated by a misconfigured API client, or a deliberate attack attempting to bypass signature-based detections.

Security Environment

Review the raw event ingested into Splunk from the AWS WAF logs. Note the specific string formatting in the URI field.

time="2023-10-24T08:14:22Z" event_source="AWS:WAF" action="ALLOW" rule_id="AWS-AWSManagedRulesCommonRuleSet" client_ip="198.51.100.104" method="GET" uri="/api/v1/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" headers_host="api.retail-prod.internal" http_version="HTTP/2.0"

Analyst Note: WAF action was "ALLOW". The payload slipped past the baseline ruleset.

Question

Which encoding replaces unusual ASCII characters with "%" followed by the character’s two-digit ASCII code expressed in hexadecimal?

A

Unicode Encoding

B

UTF Encoding

C

Base64 Encoding

D

URL Encoding

Hint: Look closely at the WAF log payload: %2e%2e%2f. This format is universally used by web browsers to safely transmit characters with special meanings across the internet.

Expert Insight

1. What is happening here?

The attacker is attempting a Local File Inclusion / Path Traversal attack against your API (../../etc/passwd). However, because standard WAF rules look for the literal string ../, the attacker has obfuscated the payload using URL Encoding. The WAF logged the raw request, but because it didn't decode the string before applying its signature checks, the attack was ALLOWED.

2. Why is 'URL Encoding' correct?

URL encoding (or percent-encoding) is specifically defined by RFC 3986 as the mechanism to encode information in a Uniform Resource Identifier (URI). It replaces reserved characters with a % followed by their 2-digit Hexadecimal equivalent. In our log: %2e is a dot (.), and %2f is a forward slash (/). Thus, %2e%2e%2f translates to ../.

3. Why are the other options wrong?

Base64 (C): Base64 translates binary data into an ASCII string format using a specific 64-character alphabet (A-Z, a-z, 0-9, +, /) and uses "=" for padding. It does not use the "%" symbol.
Unicode/UTF (A, B): While UTF-8 handles web text encoding, "Unicode encoding" in the context of obfuscation typically looks like \u002e or %u002e. The strict %XX format where XX is hex is URL encoding.

4. Real-world SOC Application

When you see this in the SIEM, your first step is to drop the payload into a tool like CyberChef using the "URL Decode" recipe. The immediate danger here isn't just single URL encoding—it's Double URL Encoding. If an attacker sends %252e%252e%252f, the WAF decodes it once to %2e%2e%2f, sees no malicious signature, and passes it. The backend application then decodes it a second time to ../, resulting in a successful exploit.

🧠 SOC Mini Lesson: Detecting Evasion Techniques

As a Tier 3 analyst, you don't just rely on alerts; you proactively hunt for bypasses. When investigating WAF logs for obfuscation:

Analyze the WAF Configuration: Does your WAF normalize (decode) requests before inspection? If not, simple URL encoding will bypass it.
Look for Anomalous Ratios: In Splunk, run a search to calculate the ratio of % characters to total string length in URIs. Legitimate requests have low ratios; heavily encoded malicious payloads (like SQLi or XSS) will spike this ratio.
Build Resilient Logic: Don't just alert on ../. Ensure your SIEM rules parse the URI field, execute a decoding function within the query (e.g., Splunk's urldecode() command), and then apply regex matching for path traversal signatures.

CSA (312-39) SOC Simulation Lab